Entirely depends on who’s publishing the image. Many projects publish their own images, in which case you’re running their code regardless.

When I worked for a startup we’d sometimes go out for lunch and everyone would have a drink or two. We also kept beer in the office fridge but that was reserved for more Friday afternoons.

Yes but there are ways to protect against that. For instance you can configure Tailscale clients to only trust nodes that have been signed by trusted nodes, or something like that.

I greatly despise all facial hair.